CMMC Level 1 protects Federal Contract Information (FCI). Level 2 is required for Controlled Unclassified Information (CUI). Level 3 applies only to critical, high-value programs. Our 3‑phase program delivers assessment, remediation, and certification support.
The Cybersecurity Maturity Model Certification (CMMC) has three levels. Your requirement depends on the type of information your contracts involve.
Required when: Your organization handles Federal Contract Information (FCI)—information provided by or generated for the government under a contract that is not intended for public release. Level 1 focuses on safeguarding FCI with 17 practices covering basic cyber hygiene such as access control, identification and authentication, and media protection.
Required when: Your organization handles Controlled Unclassified Information (CUI)—sensitive information that requires protection but is not classified. Most DoD contractors and subcontractors in the defense industrial base require Level 2. It implements all 110 security practices from NIST SP 800-171, including advanced access controls, incident response, and audit requirements.
Required when: Only for organizations handling CUI associated with critical, high-value, or advanced technology programs. Level 3 adds practices to protect against advanced persistent threats (APTs) and is required for a smaller subset of defense contractors—typically those supporting the most sensitive unclassified programs. Most contractors need Level 1 or Level 2, not Level 3.
Level 2 (required for CUI) implements all 110 security controls across 17 control families based on NIST SP 800-171.
Access Control (AC)
Awareness and Training (AT)
Audit and Accountability (AU)
Configuration Management (CM)
Identification and Authentication (IA)
Incident Response (IR)
Maintenance (MA)
Media Protection (MP)
Personnel Security (PS)
Physical Protection (PE)
Recovery (RE)
Risk Assessment (RA)
Security Assessment (CA)
Situational Awareness (SA)
System and Communications Protection (SC)
System and Information Integrity (SI)
Our proven methodology and certified C3PAO partnerships ensure a smooth path to CMMC Level 2 certification.
Guaranteed CMMC Level 2 certification path
Expert guidance throughout the entire process
Reduced time to compliance with proven methodology
Access to Defense Department contracts
Enhanced cybersecurity posture and protection
3-Phase Process to Certification
Don't wait until it's too late. Start your CMMC Level 2 certification process today and secure your defense contracting opportunities.
Contact us today to begin your CMMC Level 2 certification process with our expert team.